Riddles are built to be GDPR-compliant

, although there are still a few things you need to do to ensure full compliance.

Information detailed on this page should not be considered as legal advice. If GDPR does not apply to your organization or the region of your users, you should consider any other relevant data laws. You can find legal GDPR documentation here.

What does GDPR-compliance mean?

The European Union’s General Data Protection Regulation (GDPR) is a comprehensive data privacy and protection law. It applies to any organization that collects or processes personal data from EU residents.

Non-compliance with GDPR can result in significant fines and legal action.

GDPR is similar to global data privacy regulations like California's Consumer Privacy Act (CCPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

What data does GDPR cover?

With Riddle, you have the ability to collect personal data, particularly for lead forms. This is why it’s important to make sure you’re set up to be GDPR-compliant.

Personal data protected by GDPR includes:

Name
Email address
Address
Photos
Bank details
Social posts
Medical information
IP address

What is my company responsible for?

You have a legal responsibility to protect any personal data you collect or process as an organization.

Riddles are built to be GDPR-compliant, but you still need to complete a few steps to ensure full compliance.

How Riddle is GDPR-compliant

Riddle data is securely stored on our EU servers

All data is stored on our own servers in Germany and Luxembourg in a secure, banking-grade data center. We do not use cloud-based or shared storage services.

By default, we only store aggregate Riddle data. If you choose to collect personal data using a lead form, there are two ways you can choose to store lead data securely.

To ensure further security of data, all logins are secured by two-factor authentication (2FA).

No tracking and zero cookies

When someone plays a Riddle, we never track any of their personal data. All of the Riddles that you create and embed never:

Set cookies of their own
Collect or store IP addresses
Use Google Analytics or any other US-based analytics (you can still add your own trackers and pixels if you’d like)
Load fonts from Google, because we serve all Google Fonts from our own servers

A few features use your visitor’s browser local storage instead of cookies. Order It, Swiper and Flashcard blocks save a simple flag so their how-to hint only shows once. If you switch on “one vote per browser” or “remember user”, the Riddle also saves its progress, and “remember user” keeps form entries so they can be pre-filled next time. That data stays on your visitor’s device and is never sent to our servers. Third-party cookies only come in if you turn on form protection such as Google reCAPTCHA or Cloudflare Turnstile. You can find a detailed list of what we store and why here.

We give users full control of their data

We’re transparent with our users, and give them full control over their data.

When users fill in lead-forms, they are given the opportunity to opt-in to how their data will be stored, processed, and used.

As a Riddle creator, you can also choose to require double-opt in. This is where leads have to go through email confirmation. Only data from confirmed emails will be stored.

We do not share or sell any data

Only you and team members with accounts can view data collected from your Riddles. This includes personal, identifiable data from lead forms.

You own all the content you create with Riddle.com. We do not make your content searchable on our website, or repurpose it for our own materials. Users can also turn off the landing page link to make sure that your content is only visible to the audience of your choice.

How to store lead data

Riddle’s interactive content and quizzes give you the ability to collect high-quality leads. You can do this by adding a lead form into your Riddle content. There are 3 ways you can securely store and share lead data in a GDPR-compliant way.

Store lead data in your own personal space on our servers

All data will be encrypted and can only be viewed by being decrypted when you or your team members securely log in to Riddle. Encrypted data cannot be accessed by our staff, unless your team:

specifically requests us to do it
has signed our Data Processing Agreement

Leads have the option to opt in to how their data is stored, processed, and used. If they take the Riddle but do not complete the form, their quiz responses will be shown as ‘withheld’.

Send data directly using native integrations

Connect your data to tools such as MailChimp, Google Sheets, and AWeber. We’ll securely send this data and it will never touch our servers. Check out all of our integrations here.

Send data directly to your own GDPR-compliant storage solutions

Use Zapier or a webhook to send data directly to your own secure database or a CRM platform. We’ll securely send this data and it will never touch our servers. You can read more about webhooks here.

You can also read more about how to generate leads in a GDPR-compliant way here.

Privacy is one part of trust. Riddle is also ISO 27001 certified and committed to accessibility following WCAG 2.2.